cli.administration.inventory.credentials package

Subpackages

Submodules

cli.administration.inventory.credentials.emit module

Recursive credentials emission into a ruamel CommentedMap.

cli.administration.inventory.credentials.emit.credentials_map(app_block: CommentedMap) → CommentedMap

The writable secrets.credentials node of one application block.

Parameters:

app_block – the applications.<app_id> map.

cli.administration.inventory.credentials.emit.declared_credentials(app_block: dict) → dict

The credentials an application block declares, empty when it declares none. Reading a malformed secrets raises rather than resolving empty.

Parameters:

app_block – the applications.<app_id> map.

cli.administration.inventory.credentials.emit.emit_credentials(schema_node: dict, dest_node: CommentedMap, *, app_id: str, key_path: str, overrides: dict[str, str], vault_handler: VaultHandler, skip_existing: bool, track_added: set[str] | None) → None

Walk a (possibly nested) credentials schema and emit one vault block per scalar leaf into dest_node. Nested dicts (e.g. secrets.credentials.recaptcha = {key, secret}) recurse into nested CommentedMaps so each leaf becomes its own vault-encrypted entry instead of being collapsed via str(dict) into a Python-repr blob (the regression that broke run 26428080957 jobs 77797371397 and 77797371442 for web-app-espocrm and web-app-listmonk).

cli.administration.inventory.credentials.emit.ensure_map(node: CommentedMap, key: str) → CommentedMap

Ensure node[key] exists and is a CommentedMap for round-trip safety. Overwrites non-CommentedMap placeholders.

cli.administration.inventory.credentials.overrides module

CLI --set override parsing and per-key resolution.

cli.administration.inventory.credentials.overrides.override_for(app_id: str, key: str, overrides: dict[str, str]) → str | None

The override value for one credential, or None when unset.

Parameters:

  • app_id – application the credential belongs to.

  • key – dotted path inside the schema’s credentials node.

  • overrides – parsed --set pairs.

cli.administration.inventory.credentials.overrides.override_key(app_id: str, key: str) → str

Build the override key for one credential.

Parameters:

  • app_id – application the credential belongs to.

  • key – dotted path inside the schema’s credentials node, e.g. recaptcha.secret.

cli.administration.inventory.credentials.overrides.parse_overrides(pairs: list[str]) → dict[str, str]

Parse --set <key>=<value> pairs into a dict.

Parameters:

pairs – raw key=value strings from the command line.

Every key MUST be the fully qualified form override_key() builds; a short form is rejected rather than guessed at, because the same short key names different credentials on different apps.

cli.administration.inventory.credentials.overrides.split_override_key(key: str) → tuple[str, str]

Split an override key back into (app_id, credential path).

Parameters:

key – a key in the shape override_key() builds.

cli.administration.inventory.credentials.prompts module

Interactive operator prompts for the credentials CLI.

cli.administration.inventory.credentials.prompts.ask_for_confirmation(key: str) → bool

Prompt the user for confirmation to overwrite an existing value.

cli.administration.inventory.credentials.vault module

Vault block construction and detection helpers.

cli.administration.inventory.credentials.vault.is_ruamel_vault(val: Any) → bool

Detect if a ruamel scalar already carries the !vault tag.

cli.administration.inventory.credentials.vault.is_vault_encrypted(val: Any) → bool

Detect if a value is already a vault string, a ruamel !vault scalar, or an internal VaultScalar from InventoryManager.apply_schema().

cli.administration.inventory.credentials.vault.to_vault_block(vault_handler: VaultHandler, value: str | Any, label: str) → Any

Return a ruamel scalar tagged as !vault. Reuses existing vault payloads (VaultScalar, ruamel !vault, $ANSIBLE_VAULT strings) and encrypts plaintext otherwise. Empty strings stay plain.

Module contents

Public API of the credentials CLI.

The package is split by concern: - vault: vault block construction + detection - overrides: --set parsing + per-key resolution - emit: recursive credentials emission into ruamel CommentedMaps - prompts: interactive operator prompts - __main__: argparse + orchestration

cli.administration.inventory.credentials.ask_for_confirmation(key: str) → bool

Prompt the user for confirmation to overwrite an existing value.

cli.administration.inventory.credentials.emit_credentials(schema_node: dict, dest_node: CommentedMap, *, app_id: str, key_path: str, overrides: dict[str, str], vault_handler: VaultHandler, skip_existing: bool, track_added: set[str] | None) → None

Walk a (possibly nested) credentials schema and emit one vault block per scalar leaf into dest_node. Nested dicts (e.g. secrets.credentials.recaptcha = {key, secret}) recurse into nested CommentedMaps so each leaf becomes its own vault-encrypted entry instead of being collapsed via str(dict) into a Python-repr blob (the regression that broke run 26428080957 jobs 77797371397 and 77797371442 for web-app-espocrm and web-app-listmonk).

cli.administration.inventory.credentials.ensure_map(node: CommentedMap, key: str) → CommentedMap

Ensure node[key] exists and is a CommentedMap for round-trip safety. Overwrites non-CommentedMap placeholders.

cli.administration.inventory.credentials.is_vault_encrypted(val: Any) → bool

Detect if a value is already a vault string, a ruamel !vault scalar, or an internal VaultScalar from InventoryManager.apply_schema().

cli.administration.inventory.credentials.main() → int
cli.administration.inventory.credentials.override_for(app_id: str, key: str, overrides: dict[str, str]) → str | None

The override value for one credential, or None when unset.

Parameters:

  • app_id – application the credential belongs to.

  • key – dotted path inside the schema’s credentials node.

  • overrides – parsed --set pairs.

cli.administration.inventory.credentials.parse_overrides(pairs: list[str]) → dict[str, str]

Parse --set <key>=<value> pairs into a dict.

Parameters:

pairs – raw key=value strings from the command line.

Every key MUST be the fully qualified form override_key() builds; a short form is rejected rather than guessed at, because the same short key names different credentials on different apps.

cli.administration.inventory.credentials.to_vault_block(vault_handler: VaultHandler, value: str | Any, label: str) → Any

Return a ruamel scalar tagged as !vault. Reuses existing vault payloads (VaultScalar, ruamel !vault, $ANSIBLE_VAULT strings) and encrypts plaintext otherwise. Empty strings stay plain.